Argument Injection Vulnerability in php-mail Package: CVE-2009-4111
Summary
DEBIAN-CVE-2009-4111: Argument injection vulnerability in Mail/sendmail.php in the Mail package 1.1.14, 1.2.0b2, and possibly other versions for PEAR allows remote attackers to read and write arbitrary files via a crafted $recipients paramete... Affects php-mail versions < 1.1.14-2. Fixed in 1.1.14-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The php-mail package is a widely used library in the PEAR ecosystem that facilitates the sending of emails from PHP applications. It provides a simple interface for composing and sending emails, supporting various transport methods. However, certain versions of this package are vulnerable to an argument injection flaw, which can lead to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability, identified as CVE-2009-4111, originates from an argument injection flaw in the Mail/sendmail.php script of the php-mail package versions 1.1.14, 1.2.0b2, and potentially others. This flaw allows remote attackers to exploit the $recipients parameter and possibly other parameters to read and write arbitrary files on the server. The implications of this vulnerability can be severe, as it may lead to unauthorized data exposure or manipulation, compromising the integrity and confidentiality of the affected system.
How To Fix
Minimum fixed version
1.1.14-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade php-mailTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the affected scripts or implementing input validation to sanitize the $recipients parameter. This can help mitigate the risk of exploitation until a proper update can be applied.
Conclusion
In summary, CVE-2009-4111 represents a significant security risk for applications using vulnerable versions of the php-mail package. It is crucial to update to the patched version to mitigate the risk of exploitation. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for php-mail →
FAQ
CVE-2009-4111 is a vulnerability in the php-mail package that allows remote attackers to exploit argument injection flaws, potentially leading to unauthorized file access.
The vulnerability affects php-mail versions 1.1.14, 1.2.0b2, and possibly other versions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive files, data manipulation, and potential system compromise.
If an immediate update is not possible, implement input validation to sanitize user inputs and restrict access to the affected scripts as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for php-mail.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
